Exploiting OPC-UA in Every Possible Way: Practical Attacks Against Modern OPC-UA Architectures
summary
Research finds about 50 CVEs and develops 12 attack concepts across OPC-UA stacks; a custom client, fuzzers and coverage harnesses uncover widespread issues. Demonstrations include a chunk-flooding DoS that exhausts servers, a malformed UTF8→UTF16 heap-leak leading to out‑of‑bounds read/write and RCE in Kepware, and browser XSS from malicious server responses chained to RCE in Ignition and Softing via gateway scripts and zip path‑traversal. An open exploit framework and PoCs are released.
AI-written summary · about
chapters (9)
- 0:00Introduction to OPC UA
- 2:00OPC UA protocol explained
- 6:20Research methodology
- 8:29Technical core concepts
- 11:25Vulnerability testing
- 16:59Denial of service attacks
- 22:27Remote code execution
- 30:35Exploiting OPC UA clients
- 36:46Framework and conclusion
related talks
18mA Comprehensive Formal Security Analysis of OPC UA
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
45mWhen Machines Can't Talk
26mHacking buildings: Security flaws in embedded building control systems
28mUnveiling Remote Code Execution: How Vulnerabilities Lead to System Takeovers
37mFinding Vulnerabilities in IoT Embedded Devices Using Linux OS and Open Source Tools
35mInside a hacker’s mind